4 ms·

Wow that seems like a pretty weird limitation. Wouldn't you be able to use the same password on a different device?

lucideer 8y ago
SSB uses a simple immutable ledger per identity; merging isn't something that's supported architecturally. Their plan is to support this at a client level: you create multiple identities with metadata indicating that all are the same person on different devices, which clients can then use to group them appropriately in whatever way makes sense. UX wise, it may make sense for some clients to obscure this architecture from new users somewhat and treat them visually as the same identity, but that's down the line (and I'm sure some purist clients will never want to do this).
- staltz 8y ago
  And progress has been to get there with the recent v3 of [ssb-friends](https://github.com/ssbc/ssb-friends/ https://github.com/ssbc/ssb-friends/)
  - marknadal 8y ago
    I've been telling Dominic and Juan (even Feross, Mathias, etc.) that there is a simple fix for this with CRDTs (GUN's or not) since 2014 - Dominic (SSB) has been the most cutting edge, he adopted some CRDTs I think for log relay, why not also for identity? Skip to 11:45 into the video, the algorithm/cryptography for it isn't that hard either: https://www.decentralizedweb.net/videos/talk-better-algorithms-for-a-decentralized-webthe-gun-stack/ https://www.decentralizedweb.net/videos/talk-better-algorith... you could do it in SSB without needing gun!
    - xj9 8y ago
      the only way to share identity in a crypto-cap system is to share privkeys, which is a big no-no. much, much safer to have multiple privkeys that are linked with signatures. you probably shouldn't think of ssb id keys as having a 1:1 relationship with a person. they are more like device keys, the person ID is a higher level construct that is expressed by publishing links that assert that a set of keys belong to the same agent.
      - ChristianBundy 8y ago
        This is similar to how it works with applications like Signal: each device has its own keypair and a person can have multiple devices. The only difference is that currently we don't have a universal way to do this, although it is in the pipeline.
        marknadal 8y ago
        You can think of keys as being a device key. But now you just kick the can back. You still have to have an account that manages the device keys, and you certainly don't want that locked down to a device - unless that device is the user's brain. So either way, you're still gonna have to use a system to manage it that looks 110% like the MIT Open Source security/cryptography code anybody can rip from us.
        notriddle 8y ago
        > But now you just kick the can back. You still have to have an account that manages the device keys, and you certainly don't want that locked down to a device They need to mutually confirm it. If keyA says sameAs keyB, and keyB says sameAs keyA, then they should be considered merged.
        xj9 8y ago
        there is no account only capabilities accept this, find peace
        marknadal 8y ago
        Please don't, we need more competition in the space. If you guys do this, you'll shoot your user adoption in the foot. Do you really think XYZ millions of users moving from FB in the next decade, when they come to SSB or NAB, are going to choose the one that is intentionally more complicated/confusing/harder-to-use? Get passwords working in cryptographically secure ways and the world will be at more peace.
        8y ago
- ChristianBundy 8y ago
  Exactly this. You can use the same identity on multiple devices, but if you post on both devices at the same time you're going to fork your feed.
jeswin 8y ago
SSB is basically a database log that syncs with your peers. Your log is immutable and message order is preserved - every message+previous_hash is signed - a hashchain that enforces order. Your peers can verify that the log has not been tampered with (both order and contents). This doesn't work with multiple devices, since they'll be two different logs. However, there is ongoing work to support multiple identities. One identity could broadcast that another identity is a "sameAs" - causing friendly peers to sync with the other identity as well. Personally, I haven't found this to be a problem. I find separate identities less distracting. (My favorite reason to use SSB is that continuous syncing is not an expectation.)
- tomcam 8y ago
  > Personally, I haven't found this to be a problem. I find separate identities less distracting. (My favorite reason to use SSB is that continuous syncing is not an expectation.) A luxury not shared by marginalized persons, such as closeted gay or trans folks, political dissidents in repressive countries, or conservatives in Silicon Valley
  - marchenko 8y ago
    Your comment makes me think I'm misunderstanding identity management on SSB: don't marginalized folk usually maintain multiple "firewalled" social media identities? Is this not the default state of the Manyverse, with users hacking identity correlation by claiming "I, X, am also Y (proof)"? The worst case scenario here in terms of false claims and doxxing does not seem different than the mainstream social media services - am I mistaken?

SSB uses a simple immutable ledger per identity; merging isn't something that's supported architecturally. Their plan is to support this at a client level: you create multiple identities with metadata indicating that all are the same person on different devices, which clients can then use to group them appropriately in whatever way makes sense. UX wise, it may make sense for some clients to obscure this architecture from new users somewhat and treat them visually as the same identity, but that's down the line (and I'm sure some purist clients will never want to do this).

staltz 8y ago
And progress has been to get there with the recent v3 of [ssb-friends](https://github.com/ssbc/ssb-friends/ https://github.com/ssbc/ssb-friends/)
- marknadal 8y ago
  I've been telling Dominic and Juan (even Feross, Mathias, etc.) that there is a simple fix for this with CRDTs (GUN's or not) since 2014 - Dominic (SSB) has been the most cutting edge, he adopted some CRDTs I think for log relay, why not also for identity? Skip to 11:45 into the video, the algorithm/cryptography for it isn't that hard either: https://www.decentralizedweb.net/videos/talk-better-algorithms-for-a-decentralized-webthe-gun-stack/ https://www.decentralizedweb.net/videos/talk-better-algorith... you could do it in SSB without needing gun!
  - xj9 8y ago
    the only way to share identity in a crypto-cap system is to share privkeys, which is a big no-no. much, much safer to have multiple privkeys that are linked with signatures. you probably shouldn't think of ssb id keys as having a 1:1 relationship with a person. they are more like device keys, the person ID is a higher level construct that is expressed by publishing links that assert that a set of keys belong to the same agent.
    - ChristianBundy 8y ago
      This is similar to how it works with applications like Signal: each device has its own keypair and a person can have multiple devices. The only difference is that currently we don't have a universal way to do this, although it is in the pipeline.
      - marknadal 8y ago
        You can think of keys as being a device key. But now you just kick the can back. You still have to have an account that manages the device keys, and you certainly don't want that locked down to a device - unless that device is the user's brain. So either way, you're still gonna have to use a system to manage it that looks 110% like the MIT Open Source security/cryptography code anybody can rip from us.
        notriddle 8y ago
        > But now you just kick the can back. You still have to have an account that manages the device keys, and you certainly don't want that locked down to a device They need to mutually confirm it. If keyA says sameAs keyB, and keyB says sameAs keyA, then they should be considered merged.
        xj9 8y ago
        there is no account only capabilities accept this, find peace
        marknadal 8y ago
        Please don't, we need more competition in the space. If you guys do this, you'll shoot your user adoption in the foot. Do you really think XYZ millions of users moving from FB in the next decade, when they come to SSB or NAB, are going to choose the one that is intentionally more complicated/confusing/harder-to-use? Get passwords working in cryptographically secure ways and the world will be at more peace.
        8y ago
ChristianBundy 8y ago
Exactly this. You can use the same identity on multiple devices, but if you post on both devices at the same time you're going to fork your feed.

jeswin 8y ago

SSB is basically a database log that syncs with your peers. Your log is immutable and message order is preserved - every message+previous_hash is signed - a hashchain that enforces order. Your peers can verify that the log has not been tampered with (both order and contents). This doesn't work with multiple devices, since they'll be two different logs. However, there is ongoing work to support multiple identities. One identity could broadcast that another identity is a "sameAs" - causing friendly peers to sync with the other identity as well. Personally, I haven't found this to be a problem. I find separate identities less distracting. (My favorite reason to use SSB is that continuous syncing is not an expectation.)

tomcam 8y ago
> Personally, I haven't found this to be a problem. I find separate identities less distracting. (My favorite reason to use SSB is that continuous syncing is not an expectation.) A luxury not shared by marginalized persons, such as closeted gay or trans folks, political dissidents in repressive countries, or conservatives in Silicon Valley
- marchenko 8y ago
  Your comment makes me think I'm misunderstanding identity management on SSB: don't marginalized folk usually maintain multiple "firewalled" social media identities? Is this not the default state of the Manyverse, with users hacking identity correlation by claiming "I, X, am also Y (proof)"? The worst case scenario here in terms of false claims and doxxing does not seem different than the mainstream social media services - am I mistaken?